feat(auth): add username sign-in mode and recovery kits (#3215)

fluxer_admin/tests/api_deserialization.rs

@@ -441,6 +441,7 @@ fn deserialize_instance_config_response_with_unknown_keys() {
             "pending_registrations": []
         },
         "self_hosted": false,
+        "account_identity": {"mode": "username", "locked": true, "tag_style": "none"},
         "app_public": {
             "branding": {
                 "product_name": "Fluxer",
@@ -601,9 +602,15 @@ fn deserialize_instance_config_response_with_unknown_keys() {
     assert_eq!(resp.app_public.branding.premium_product_name, "Gold");
     assert!(resp.billing.billing_active);
     assert!(resp.media.attachment_decay.effective.enabled);
+    assert!(resp.account_identity.locked);
 
     let ours: types::InstanceConfigResponse =
         serde_json::from_str(json).expect("hand-written instance config");
+    assert_eq!(
+        ours.account_identity.mode,
+        types::AccountIdentityMode::Username
+    );
+    assert_eq!(ours.account_identity.locked, Some(true));
     assert_eq!(ours.app_public.branding.premium_product_name, "Gold");
     assert!(ours.billing.stripe_secret_key_stored);
     assert_eq!(ours.billing.tax_id_collection, Some(true));
@@ -1069,3 +1076,11 @@ fn deserialize_list_admin_api_key_entry() {
     assert_eq!(resp.created_by_user_id, "1130650140672000000");
     assert_eq!(resp.acls.len(), 2);
 }
+
+#[test]
+fn account_identity_lock_is_unknown_when_the_api_omits_it() {
+    let identity: types::AccountIdentityConfigResponse =
+        serde_json::from_str("{}").expect("empty account identity");
+    assert_eq!(identity.mode, types::AccountIdentityMode::Email);
+    assert_eq!(identity.locked, None);
+}

fluxer_admin/tests/password_reset_link.rs

@@ -0,0 +1,446 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+#![recursion_limit = "256"]
+
+use axum::{
+    Json, Router,
+    body::{Body, to_bytes},
+    extract::State,
+    http::{Method, Request, StatusCode, Uri, header},
+    response::{IntoResponse, Response},
+};
+use fluxer_admin::{
+    build_router,
+    config::{AdminConfig, ProxyConfig, RuntimeEnv},
+    session,
+};
+use serde_json::{Value, json};
+use std::sync::{Arc, Mutex};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+const SECRET_KEY: &str = "password-reset-link-test-secret";
+const ADMIN_ID: &str = "1500000000000000000";
+const TARGET_ID: &str = "1500000000000000042";
+const RESET_URL: &str = "https://chat.example.test/reset#token=one-time-reset-token";
+
+#[derive(Clone)]
+struct MockApi {
+    account_identity: &'static str,
+    admin_acls: Vec<&'static str>,
+    requests: Arc<Mutex<Vec<String>>>,
+}
+
+#[tokio::test]
+async fn creating_a_reset_link_shows_the_url_once_with_a_copy_button() {
+    let app = setup(true, "username", vec!["*"]).await;
+    let csrf_token = csrf_token(&app).await;
+    let (status, body) = post_form(
+        &app,
+        &format!("/users/{TARGET_ID}?action=create_password_reset_link&tab=account"),
+        &format!("_csrf={csrf_token}"),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(app.saw(&format!(
+        "POST /admin/users/{TARGET_ID}/password-reset-link"
+    )));
+    assert!(body.contains("Copy this link now. It is shown only once."));
+    assert!(body.contains(&format!(r#"value="{RESET_URL}""#)));
+    assert!(body.contains(&format!(r#"data-copy-value="{RESET_URL}""#)));
+    assert!(body.contains("Copy Link"));
+
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Create Password Reset Link"));
+    assert!(!page.contains(RESET_URL));
+}
+
+#[tokio::test]
+async fn an_htmx_reset_link_request_gets_only_the_result_fragment() {
+    let app = setup(true, "username", vec!["*"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains(r##"hx-target="#password-reset-link-result""##));
+    assert!(page.contains(r#"hx-push-url="false""#));
+    let csrf_token = csrf_token(&app).await;
+    let (status, body) = post_form_with_headers(
+        &app,
+        &format!("/users/{TARGET_ID}?action=create_password_reset_link&tab=account"),
+        &format!("_csrf={csrf_token}"),
+        &[
+            ("HX-Request", "true"),
+            ("HX-Target", "password-reset-link-result"),
+        ],
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(
+        body.starts_with(r#"<div id="password-reset-link-result""#),
+        "{body}"
+    );
+    assert!(body.contains(r#"hx-history="false""#));
+    assert!(body.contains(&format!(r#"data-copy-value="{RESET_URL}""#)));
+    assert!(!body.contains("<html"));
+    assert!(!body.contains("Create Password Reset Link"));
+}
+
+#[tokio::test]
+async fn revoking_a_recovery_kit_calls_the_api() {
+    let app = setup(true, "username", vec!["*"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Revoke Recovery Kit"));
+    let csrf_token = csrf_token(&app).await;
+    let (status, _) = post_form(
+        &app,
+        &format!("/users/{TARGET_ID}?action=revoke_recovery_kit&tab=account"),
+        &format!("_csrf={csrf_token}"),
+    )
+    .await;
+    assert!(status.is_redirection() || status.is_success(), "{status}");
+    assert!(app.saw(&format!("DELETE /admin/users/{TARGET_ID}/recovery-kit")));
+}
+
+#[tokio::test]
+async fn the_revoke_recovery_kit_action_needs_its_acl_and_a_username_instance() {
+    let without_acl = setup(
+        true,
+        "username",
+        vec![
+            "admin:authenticate",
+            "user:lookup",
+            "user:create:password_reset_link",
+        ],
+    )
+    .await;
+    let page = get(&without_acl, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Create Password Reset Link"));
+    assert!(!page.contains("Revoke Recovery Kit"));
+
+    let with_acl = setup(
+        true,
+        "username",
+        vec![
+            "admin:authenticate",
+            "user:lookup",
+            "user:delete:recovery_kit",
+        ],
+    )
+    .await;
+    let page = get(&with_acl, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Revoke Recovery Kit"));
+
+    let email = setup(true, "email", vec!["*"]).await;
+    let page = get(&email, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(!page.contains("Revoke Recovery Kit"));
+}
+
+#[tokio::test]
+async fn username_instances_hide_email_actions_on_the_account_tab() {
+    let app = setup(true, "username", vec!["*"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Create Password Reset Link"));
+    assert!(!page.contains("Send Password Reset"));
+    assert!(!page.contains("Change Email"));
+    assert!(!page.contains("Verify Email"));
+}
+
+#[tokio::test]
+async fn the_reset_link_action_needs_its_acl() {
+    let app = setup(true, "username", vec!["admin:authenticate", "user:lookup"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Terminate All Sessions"));
+    assert!(!page.contains("Create Password Reset Link"));
+    assert!(!page.contains("Send Password Reset"));
+}
+
+#[tokio::test]
+async fn email_instances_keep_the_email_actions() {
+    let app = setup(true, "email", vec!["*"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Send Password Reset"));
+    assert!(page.contains("Change Email"));
+    assert!(page.contains("Verify Email"));
+    assert!(!page.contains("Create Password Reset Link"));
+}
+
+#[tokio::test]
+async fn the_email_ban_notice_stays_after_a_ban_action_on_a_username_instance() {
+    let notice = "Accounts have no email address, so email bans have no effect.";
+    let username = setup(true, "username", vec!["*"]).await;
+    let username_csrf = csrf_token(&username).await;
+    let (status, body) = post_form(
+        &username,
+        "/email-bans?action=ban",
+        &format!("_csrf={username_csrf}&email="),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(body.contains("Value is required"));
+    assert!(body.contains(notice));
+
+    let email = setup(true, "email", vec!["*"]).await;
+    let email_csrf = csrf_token(&email).await;
+    let (_, body) = post_form(
+        &email,
+        "/email-bans?action=ban",
+        &format!("_csrf={email_csrf}&email="),
+    )
+    .await;
+    assert!(body.contains("Value is required"));
+    assert!(!body.contains(notice));
+}
+
+#[tokio::test]
+async fn hosted_admin_never_asks_discovery_for_the_sign_in_method() {
+    let app = setup(false, "username", vec!["*"]).await;
+    let page = get(&app, &format!("/users/{TARGET_ID}?tab=account")).await;
+    assert!(page.contains("Send Password Reset"));
+    assert!(!page.contains("Create Password Reset Link"));
+    assert!(!app.saw("GET /.well-known/fluxer"));
+}
+
+struct TestApp {
+    router: Router,
+    session_cookie: String,
+    requests: Arc<Mutex<Vec<String>>>,
+}
+
+impl TestApp {
+    fn saw(&self, route: &str) -> bool {
+        self.requests
+            .lock()
+            .expect("requests")
+            .iter()
+            .any(|seen| seen == route)
+    }
+}
+
+async fn setup(
+    self_hosted: bool,
+    account_identity: &'static str,
+    admin_acls: Vec<&'static str>,
+) -> TestApp {
+    let requests = Arc::new(Mutex::new(Vec::new()));
+    let api_endpoint = spawn_mock_api(MockApi {
+        account_identity,
+        admin_acls,
+        requests: Arc::clone(&requests),
+    })
+    .await;
+    let router = build_router(test_config(api_endpoint, self_hosted));
+    let session_value = session::create_session(ADMIN_ID, "test-token", SECRET_KEY);
+    TestApp {
+        router,
+        session_cookie: format!("{}={session_value}", session::SESSION_COOKIE_NAME),
+        requests,
+    }
+}
+
+async fn get(app: &TestApp, uri: &str) -> String {
+    let response = app
+        .router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri(uri)
+                .header(header::COOKIE, &app.session_cookie)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK, "{uri}");
+    body_text(response).await
+}
+
+async fn csrf_token(app: &TestApp) -> String {
+    let response = app
+        .router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri(format!("/users/{TARGET_ID}?tab=account"))
+                .header(header::COOKIE, &app.session_cookie)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .find_map(|value| {
+            let pair = value.split(';').next()?;
+            let token = pair
+                .strip_prefix("__Host-csrf_token=")
+                .or_else(|| pair.strip_prefix("csrf_token="))?;
+            (!token.is_empty()).then(|| token.to_owned())
+        })
+        .expect("csrf_token cookie")
+}
+
+async fn post_form(app: &TestApp, uri: &str, body: &str) -> (StatusCode, String) {
+    post_form_with_headers(app, uri, body, &[]).await
+}
+
+async fn post_form_with_headers(
+    app: &TestApp,
+    uri: &str,
+    body: &str,
+    headers: &[(&str, &str)],
+) -> (StatusCode, String) {
+    let csrf = body
+        .split('&')
+        .find_map(|pair| pair.strip_prefix("_csrf="))
+        .expect("form carries a csrf token");
+    let mut request = Request::builder()
+        .method(Method::POST)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(
+            header::COOKIE,
+            format!("{}; __Host-csrf_token={csrf}", app.session_cookie),
+        );
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    let response = app
+        .router
+        .clone()
+        .oneshot(request.body(Body::from(body.to_owned())).unwrap())
+        .await
+        .unwrap();
+    let status = response.status();
+    (status, body_text(response).await)
+}
+
+async fn body_text(response: Response) -> String {
+    let bytes = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    String::from_utf8(bytes.to_vec()).unwrap()
+}
+
+async fn spawn_mock_api(mock: MockApi) -> String {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, Router::new().fallback(mock_api).with_state(mock))
+            .await
+            .unwrap();
+    });
+    format!("http://{addr}")
+}
+
+async fn mock_api(State(mock): State<MockApi>, method: Method, uri: Uri) -> Response {
+    let path = uri.path().to_owned();
+    mock.requests
+        .lock()
+        .expect("requests")
+        .push(format!("{method} {path}"));
+    let target_user = format!("/admin/users/{TARGET_ID}");
+    let target_sessions = format!("{target_user}/sessions");
+    let target_credentials = format!("{target_user}/webauthn-credentials");
+    let target_reset_link = format!("{target_user}/password-reset-link");
+    let target_recovery_kit = format!("{target_user}/recovery-kit");
+    match (method, path.as_str()) {
+        (Method::GET, "/admin/users/@me") => Json(json!({
+            "user": user(ADMIN_ID, "AdminUser", &mock.admin_acls)
+        }))
+        .into_response(),
+        (Method::GET, "/.well-known/fluxer") => Json(json!({
+            "features": {
+                "premium_enabled": false,
+                "account_identity": mock.account_identity
+            }
+        }))
+        .into_response(),
+        (Method::GET, p) if p == target_user => Json(json!({
+            "users": [user(TARGET_ID, "member", &[])]
+        }))
+        .into_response(),
+        (Method::GET, p) if p == target_sessions => Json(json!({ "sessions": [] })).into_response(),
+        (Method::GET, p) if p == target_credentials => Json(json!([])).into_response(),
+        (Method::POST, p) if p == target_reset_link => Json(json!({
+            "url": RESET_URL,
+            "expires_at": "2026-10-01T13:00:00.000Z"
+        }))
+        .into_response(),
+        (Method::DELETE, p) if p == target_recovery_kit => StatusCode::NO_CONTENT.into_response(),
+        _ => (
+            StatusCode::NOT_FOUND,
+            Json(json!({ "message": "not found" })),
+        )
+            .into_response(),
+    }
+}
+
+fn user(id: &str, username: &str, acls: &[&str]) -> Value {
+    json!({
+        "id": id,
+        "username": username,
+        "discriminator": 1,
+        "avatar": null,
+        "banner": null,
+        "email": null,
+        "email_verified": false,
+        "email_bounced": false,
+        "global_name": username,
+        "bio": null,
+        "pronouns": null,
+        "accent_color": null,
+        "date_of_birth": null,
+        "locale": "en-GB",
+        "acls": acls,
+        "traits": [],
+        "flags": "0",
+        "premium_flags": 0,
+        "bot": false,
+        "system": false,
+        "premium_type": null,
+        "premium_since": null,
+        "premium_until": null,
+        "premium_grace_ends_at": null,
+        "premium_lifetime_sequence": null,
+        "has_totp": false,
+        "authenticator_types": [],
+        "temp_banned_until": null,
+        "pending_deletion_at": null,
+        "pending_bulk_message_deletion_at": null,
+        "deletion_reason_code": null,
+        "deletion_public_reason": null,
+        "deletion_audit_log_reason": null,
+        "deletion_scheduled_by": null,
+        "deletion_scheduled_at": null,
+        "last_active_at": null,
+        "last_active_ip": null,
+        "last_active_ip_reverse": null,
+        "last_active_location": null
+    })
+}
+
+fn test_config(api_endpoint: String, self_hosted: bool) -> AdminConfig {
+    AdminConfig {
+        env: RuntimeEnv::Test,
+        host: "127.0.0.1".to_owned(),
+        port: 0,
+        secret_key_base: SECRET_KEY.to_owned(),
+        base_path: String::new(),
+        api_endpoint,
+        media_endpoint: "https://media.example.test".to_owned(),
+        static_cdn_endpoint: "https://static.example.test".to_owned(),
+        admin_endpoint: "https://admin.example.test".to_owned(),
+        web_app_endpoint: "https://app.example.test".to_owned(),
+        oauth_client_id: "admin-client".to_owned(),
+        oauth_client_secret: "admin-secret".to_owned(),
+        oauth_redirect_uri: "https://admin.example.test/callback".to_owned(),
+        build_version: "test".to_owned(),
+        self_hosted,
+        proxy: ProxyConfig {
+            trust_client_ip_header: false,
+            client_ip_header_name: "x-forwarded-for".to_owned(),
+        },
+    }
+}

fluxer_admin/tests/username_tags.rs

@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+#![recursion_limit = "256"]
+
+use axum::{
+    Json, Router,
+    body::{Body, to_bytes},
+    extract::State,
+    http::{Method, Request, StatusCode, Uri, header},
+    response::{IntoResponse, Response},
+};
+use fluxer_admin::{
+    build_router,
+    config::{AdminConfig, ProxyConfig, RuntimeEnv},
+    session,
+};
+use serde_json::{Value, json};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+const SECRET_KEY: &str = "username-tags-test-secret";
+const ADMIN_ID: &str = "1500000000000000000";
+const TARGET_ID: &str = "1500000000000000042";
+const DISCRIMINATOR_INPUT: &str = r#"name="discriminator""#;
+
+#[derive(Clone)]
+struct MockApi {
+    account_identity: &'static str,
+    unique_usernames: bool,
+    target: Value,
+}
+
+#[tokio::test]
+async fn username_instances_show_humans_without_a_tag() {
+    let page = account_page(true, "username", user(TARGET_ID, "member", 0, false)).await;
+    assert!(page.contains(r#"<p class="break-words text-sm text-neutral-500">member</p>"#));
+    assert!(page.contains(r#"<div class="truncate text-neutral-500 text-xs">lilith</div>"#));
+    assert!(!page.contains("member#0000"));
+    assert!(!page.contains("lilith#0000"));
+    assert!(!page.contains(DISCRIMINATOR_INPUT));
+}
+
+#[tokio::test]
+async fn email_instances_with_random_tags_show_tags_and_allow_tag_changes() {
+    let page =
+        account_page_with(true, "email", false, user(TARGET_ID, "member", 1234, false)).await;
+    assert!(page.contains("member#1234"));
+    assert!(page.contains(DISCRIMINATOR_INPUT));
+}
+
+#[tokio::test]
+async fn email_instances_with_no_tags_show_humans_without_a_tag() {
+    let page = account_page_with(true, "email", true, user(TARGET_ID, "member", 0, false)).await;
+    assert!(page.contains(r#"<p class="break-words text-sm text-neutral-500">member</p>"#));
+    assert!(!page.contains("member#0000"));
+    assert!(!page.contains("lilith#0000"));
+    assert!(!page.contains(DISCRIMINATOR_INPUT));
+    assert!(page.contains("Send Password Reset"));
+}
+
+#[tokio::test]
+async fn username_instances_never_show_tags_even_if_told_random() {
+    let page =
+        account_page_with(true, "username", false, user(TARGET_ID, "member", 0, false)).await;
+    assert!(!page.contains("member#0000"));
+    assert!(!page.contains(DISCRIMINATOR_INPUT));
+}
+
+#[tokio::test]
+async fn username_instances_keep_bot_tags() {
+    let page = account_page(true, "username", user(TARGET_ID, "helper", 4363, true)).await;
+    assert!(page.contains("helper#4363"));
+    assert!(page.contains(DISCRIMINATOR_INPUT));
+}
+
+#[tokio::test]
+async fn email_instances_keep_the_zero_tag() {
+    let page = account_page(true, "email", user(TARGET_ID, "member", 0, false)).await;
+    assert!(page.contains("member#0000"));
+    assert!(page.contains("lilith#0000"));
+    assert!(page.contains(DISCRIMINATOR_INPUT));
+}
+
+#[tokio::test]
+async fn hosted_admin_keeps_the_zero_tag() {
+    let page = account_page(false, "username", user(TARGET_ID, "member", 0, false)).await;
+    assert!(page.contains("member#0000"));
+    assert!(page.contains(DISCRIMINATOR_INPUT));
+}
+
+async fn account_page(self_hosted: bool, account_identity: &'static str, target: Value) -> String {
+    account_page_with(
+        self_hosted,
+        account_identity,
+        account_identity == "username",
+        target,
+    )
+    .await
+}
+
+async fn account_page_with(
+    self_hosted: bool,
+    account_identity: &'static str,
+    unique_usernames: bool,
+    target: Value,
+) -> String {
+    let api_endpoint = spawn_mock_api(MockApi {
+        account_identity,
+        unique_usernames,
+        target,
+    })
+    .await;
+    let router = build_router(test_config(api_endpoint, self_hosted));
+    let session_value = session::create_session(ADMIN_ID, "test-token", SECRET_KEY);
+    let response = router
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri(format!("/users/{TARGET_ID}?tab=account"))
+                .header(
+                    header::COOKIE,
+                    format!("{}={session_value}", session::SESSION_COOKIE_NAME),
+                )
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let bytes = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    String::from_utf8(bytes.to_vec()).unwrap()
+}
+
+async fn spawn_mock_api(mock: MockApi) -> String {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, Router::new().fallback(mock_api).with_state(mock))
+            .await
+            .unwrap();
+    });
+    format!("http://{addr}")
+}
+
+async fn mock_api(State(mock): State<MockApi>, method: Method, uri: Uri) -> Response {
+    let target_user = format!("/admin/users/{TARGET_ID}");
+    let target_sessions = format!("{target_user}/sessions");
+    let target_credentials = format!("{target_user}/webauthn-credentials");
+    match (method, uri.path()) {
+        (Method::GET, "/admin/users/@me") => Json(json!({
+            "user": user(ADMIN_ID, "lilith", 0, false)
+        }))
+        .into_response(),
+        (Method::GET, "/.well-known/fluxer") => Json(json!({
+            "features": {
+                "premium_enabled": false,
+                "account_identity": mock.account_identity,
+                "tag_style": if mock.unique_usernames { "none" } else { "random" }
+            }
+        }))
+        .into_response(),
+        (Method::GET, p) if p == target_user => {
+            Json(json!({ "users": [mock.target] })).into_response()
+        }
+        (Method::GET, p) if p == target_sessions => Json(json!({ "sessions": [] })).into_response(),
+        (Method::GET, p) if p == target_credentials => Json(json!([])).into_response(),
+        _ => (
+            StatusCode::NOT_FOUND,
+            Json(json!({ "message": "not found" })),
+        )
+            .into_response(),
+    }
+}
+
+fn user(id: &str, username: &str, discriminator: u16, bot: bool) -> Value {
+    json!({
+        "id": id,
+        "username": username,
+        "discriminator": discriminator,
+        "avatar": null,
+        "banner": null,
+        "email": null,
+        "email_verified": false,
+        "email_bounced": false,
+        "global_name": null,
+        "bio": null,
+        "pronouns": null,
+        "accent_color": null,
+        "date_of_birth": null,
+        "locale": "en-GB",
+        "acls": ["*"],
+        "traits": [],
+        "flags": "0",
+        "premium_flags": 0,
+        "bot": bot,
+        "system": false,
+        "premium_type": null,
+        "premium_since": null,
+        "premium_until": null,
+        "premium_grace_ends_at": null,
+        "premium_lifetime_sequence": null,
+        "has_totp": false,
+        "authenticator_types": [],
+        "temp_banned_until": null,
+        "pending_deletion_at": null,
+        "pending_bulk_message_deletion_at": null,
+        "deletion_reason_code": null,
+        "deletion_public_reason": null,
+        "deletion_audit_log_reason": null,
+        "deletion_scheduled_by": null,
+        "deletion_scheduled_at": null,
+        "last_active_at": null,
+        "last_active_ip": null,
+        "last_active_ip_reverse": null,
+        "last_active_location": null
+    })
+}
+
+fn test_config(api_endpoint: String, self_hosted: bool) -> AdminConfig {
+    AdminConfig {
+        env: RuntimeEnv::Test,
+        host: "127.0.0.1".to_owned(),
+        port: 0,
+        secret_key_base: SECRET_KEY.to_owned(),
+        base_path: String::new(),
+        api_endpoint,
+        media_endpoint: "https://media.example.test".to_owned(),
+        static_cdn_endpoint: "https://static.example.test".to_owned(),
+        admin_endpoint: "https://admin.example.test".to_owned(),
+        web_app_endpoint: "https://app.example.test".to_owned(),
+        oauth_client_id: "admin-client".to_owned(),
+        oauth_client_secret: "admin-secret".to_owned(),
+        oauth_redirect_uri: "https://admin.example.test/callback".to_owned(),
+        build_version: "test".to_owned(),
+        self_hosted,
+        proxy: ProxyConfig {
+            trust_client_ip_header: false,
+            client_ip_header_name: "x-forwarded-for".to_owned(),
+        },
+    }
+}